lov-rename-project

Pass

Audited by Gen Agent Trust Hub on Oct 18, 2026

Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONPERSISTENCE
Full Analysis
  • [COMMAND_EXECUTION]: The scripts/rename_project.py script invokes git and gh binaries using the subprocess module to manage repository state and perform project renaming. The utility validates the new project name against a strict alphanumeric regular expression to mitigate command injection risks.\n- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted project files to identify strings for replacement. While it primarily generates reports and performs text substitution, the processing of external project data represents a potential surface for indirect prompt injection if malicious instructions are embedded within the scanned files.\n- [PERSISTENCE]: The scripts/profile_store.py script manages a local profile in the user's home directory to persist preferences. It includes explicit checks to prevent the storage of sensitive fields such as tokens or passwords, adhering to security best practices for local state management.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 18, 2026, 04:29 PM